Tagged Questions
0
votes
0answers
68 views
Client Side Negotiation
I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache.
But still vulnerability report says I am vulnerable to client side renegotiation and "This server is ...
10
votes
4answers
628 views
Security measures against packet sniffing
I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
3
votes
3answers
344 views
What is the actual security of this login page?
Please visit https://devforums.apple.com
If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show.
Does this ...
8
votes
2answers
584 views
HSTS extra security over HTTPS
Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS)
Also does HSTS make even the resources like CSS, images to be ...
19
votes
4answers
7k views
Why is passing the session id as url parameter insecure?
I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
0
votes
0answers
31 views
Access Populated server [closed]
I don't know if this is the write forum to post this on... If it's not sorry to bother you!
I'm going to need to get into a server which can accept ~x users; however, ~2*x users will be trying to ...
4
votes
4answers
2k views
Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP
The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well.
In addition there are a ...
3
votes
3answers
211 views
Where's the security when a payment gateway let website handle Credit Card detail
Has anyone worked with eWay payment gateway before?
Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends ...
9
votes
2answers
2k views
Are there any statistics about webservers and browsers TLS support?
From Hackers break SSL encryption used by millions of sites:
The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
9
votes
1answer
1k views
enable browser caching with HTTPS
I understand that sensitive data should not be cached (ie, you dont want to cache an HTML file with all of your bank account details in it), but there are some things that HTTPS protected sites should ...
5
votes
5answers
446 views
Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?
In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
